Detection Content Manager and Team Lead, Halcyon

• 5-10 years in cybersecurity operations, threat analysis, or security product development
• Deep expertise in at least 2-3 of the following areas:
• Kernel driver analysis and Windows system internals
• File analysis, malware classification, and static/dynamic analysis techniques
• Digital certificates and certificate validation workflows
• Network intelligence, IP reputation, and DNS-based threat detection
• Behavioral detection and signature development
• Experience designing and implementing technical workflows and automation
• Strong understanding of ransomware TTPs and defensive countermeasures
• Proven ability to make rapid technical decisions while maintaining quality standards
• Experience building or scaling technical teams from the ground up

Desirable

• Halcyon's goal is to deliver an anti-ransomware solution that breaks new ground in what a security product can achieve. We're hiring a Manager and Team Lead of Detection Content to own and scale our security content operations, starting with kernel drivers, file analysis, and certificate management
• This is a player-coach role where you'll do hands-on content work while building the team and systems needed for growth. This will be the first hire into this team. Candidates with experience building small teams and people leadership/management is preferred
• Content Operations & Development
• Drive security content decisions for kernel drivers, file classifications, and certificate validations with direct hands-on analysis
• Build and optimize content validation pipelines balancing automation with appropriate human oversight
• Establish quality assurance processes that maintain high accuracy while meeting rapid response requirements
• Design content workflows that can scale from individual contributor work to team-based operations
• Team Building & Leadership
• Start as individual contributor and grow the team to 2-5 people in the next year while also shifting your own role into Management/Team Leadership
• Collaborate with adjacent security teams to leverage existing expertise during ramp-up
• Establish training programs and operational playbooks for content specializations
• Evaluate and redesign existing processes where improvements can drive efficiency
• Technical Architecture & Integration
• Design and implement content management workflows across multiple security content types
• Build monitoring and alerting systems for content performance and false positive detection
• Create escalation procedures for high-risk content decisions and incident response
• Establish metrics and SLAs for content delivery and quality standards